7-RFP-26-00333 Continuity of Operations Plan (COOP) Software.pdf

Request for Proposals Continuity of Operations Plan (COOP) Software

RFP-26-00333

RFP-26-00333 Page 1

IMPORTANT! PLEASE READ CAREFULLY BEFORE SUBMITTING PROPOSAL

SOLICITATION TYPE: Competitive Sealed Proposals

SOLICITATION NUMBER: RFP-26-00333

SOLICITATION TITLE: Continuity of Operations Plan (COOP) Software

BRIEF DESCRIPTION: The Hillsborough County Board of County Commissioners (County) is seeking competitive sealed proposals from experienced and qualified Contractors to provide an automated Continuity of Operations Plan (COOP) software platform for a three (3) year period.

DUE DATE & TIME: August 5, 2026, 2:00 PM Eastern Time (our clock)

ISSUING DEPARTMENT DIRECTOR:

The Director of Procurement is considered the issuing department director for the purpose of Section 2-567(c) of the Hillsborough County Procurement Protest Policy and Procedures Ordinance.

PROPOSAL SUBMISSION: The County will only accept proposals submitted through its electronic bidding system (Euna Procurement). Proposals that are submitted or delivered by non-electronic means (hard-copy paper), facsimile, electronic mail (e-mail), electronic file, or means other than through the County's electronic bidding system (Euna Procurement) will not be accepted or considered. Please visit our vendors webpage (hcfl.gov/vendors) for information regarding vendor registration, electronic bid submission, procurement opportunities, and other important resources.

TIMELINESS: To preserve the integrity of the competitive sealed proposal process, proposals submitted after the due date and time listed above, unless otherwise amended, cannot and will not be accepted. Please do not wait until the last minute, hour, or day to submit your proposal, as you may encounter technical difficulties or issues that cannot be resolved before the due date and time. When preparing to submit your proposal, please read and follow all instructions regarding formatting and other details related to the form(s) to be used. Again, please do not wait until it’s too late for assistance. We value and need your participation, so the last thing we want is for you to miss this opportunity.

QUESTIONS: ● Questions regarding technical difficulties or errors encountered while submitting proposals through Euna Procurement must be directed to

RFP-26-00333 Page 2

Euna Procurement Support at 1-844-226-3862 or support.bonfire@eunasolutions.com.

● Questions regarding the specifications or solicitation document must be directed to Procurement Services using the “messages” section in Euna Procurement for this particular procurement.

● To be given consideration, such requests must be received no later than 14 calendar days after the date of Solicitation issuance in Euna Procurement, site visit, or pre-proposal conference, whichever is later.

● Questions regarding vendor registration, training, or general questions must be directed to the Supplier Engagement Team at (813) 272-5790 or iSupplier@HCFL.gov.

CONE OF SILENCE: A Cone of Silence is in effect for this procurement; therefore, no proposer, interested party and/or their principals, officers, employees, attorneys, or agents shall communicate with County employees, the Hearing Master assigned to hear the applicable protest appeal and/or members of the Board of County Commissioners, including their aides and employees regarding this procurement and/or a related protest, except as otherwise provided in the Hillsborough County Procurement Protest Policy and Procedures Ordinance. The Cone of Silence does not prohibit a proposer from communicating with the Director of Procurement, staff in the Procurement Services Department, or the County’s attorney assigned to this procurement. Violating the Cone of Silence may disqualify the proposer from consideration for award. Please refer to the Instructions for complete details about the Cone of Silence.

INSURANCE: Insurance coverage is required for this procurement. Please see RFP-26- 00333 Insurance Requirements Attachment and Special Terms and Conditions.

SURETY (BONDS): Proposal, performance, and/or payment surety is not required for this procurement.

E-VERIFY: The Department of Homeland Security's Image Program and E-Verify apply to this procurement. Please see General Terms and Conditions for complete details and requirements.

DIGITAL ACCESSIBILITY COMPLIANCE:

Any and all information and communications technology developed, provided, procured, maintained, or otherwise made available under this Contract and intended for public access or use, shall comply with various mailto:support.bonfire@eunasolutions.com https://library.municode.com/fl/hillsborough_county/codes/code_of_ordinances,_part_a?nodeId=HICOCOORLA_CH2AD_ARTVIPR_DIV3HICOPRPRPOPR_S2-562TI https://library.municode.com/fl/hillsborough_county/codes/code_of_ordinances,_part_a?nodeId=HICOCOORLA_CH2AD_ARTVIPR_DIV3HICOPRPRPOPR_S2-562TI

RFP-26-00333 Page 3 accessibility standards. Please see General Terms and Conditions for complete details and requirements.

INSTRUCTIONS TO PROPOSERS:

Please see Sections 1.5., 1.6., and 4. for various instructions for Proposers.

RFP-26-00333 Page 4

1. SPECIFICATIONS

1.1. Scope

1.1.1 The Hillsborough County Board of County Commissioners (County) is seeking competitive sealed proposals from experienced and qualified Contractors to provide an automated Continuity of Operations Plan (COOP) software platform for the Hillsborough County Fire Rescue Department (HCFR) for a three (3) year period.

1.1.2 The County seeks to reduce the manual collection, review, and processing of COOP submissions and compliance requirements across all County departments.

1.2. Applicable Publications and Acronyms

The following publication(s) of the issue in effect on date of this solicitation, forms a part of this specification:

1.2.1 Florida Statutes (Emergency Management Act) Sections 252.31 and 252.62.

https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0200- 0299/0252/0252.html

1.2.2 Executive Order 80-29 (Disaster Preparedness) dated April 14, 1980.

https://www.floridadisaster.org/globalassets/importedpdfs/eo-80-29.pdf

1.2.3 Directive on National Continuity Policy NSPD-51/HSPD-20 dated May 4, 2007.

https://www.govinfo.gov/content/pkg/PPP-2007-book1/pdf/PPP-2007-book1-doc-pg547.pdf

1.2.4 Continuity Guidance Circular (2024 up).

https://www.fema.gov/sites/default/files/documents/fema_continuity-guidance-circular_02162026.pdf

1.2.5 Emergency Management Accreditation Program ANSI/EMAP 5-2022.

https://emap.org/wp-content/uploads/2023/04/EMAP-EMS-5-2022-Emergency-Management- Standard.pdf

1.2.6 National Incident Management System (NIMS).

https://training.fema.gov/nims/

1.2.7 Comprehensive Preparedness Guide 101 (CPG 101).

https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0200-0299/0252/0252.html https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0200-0299/0252/0252.html https://www.floridadisaster.org/globalassets/importedpdfs/eo-80-29.pdf https://www.govinfo.gov/content/pkg/PPP-2007-book1/pdf/PPP-2007-book1-doc-pg547.pdf https://www.fema.gov/sites/default/files/documents/fema_continuity-guidance-circular_02162026.pdf https://www.fema.gov/sites/default/files/documents/fema_continuity-guidance-circular_02162026.pdf https://emap.org/wp-content/uploads/2023/04/EMAP-EMS-5-2022-Emergency-Management-Standard.pdf https://emap.org/wp-content/uploads/2023/04/EMAP-EMS-5-2022-Emergency-Management-Standard.pdf https://training.fema.gov/nims/

RFP-26-00333 Page 5 https://preptoolkit.fema.gov/documents/4461741/40222908/FEMA+Comprehensive+Prepared ness+Guide+%28CPG%29+101%2C+Developing+and+Maintaining+Emergency+Operations+Plans %2C+Version+3.0%2C+September+2021..pdf/f74300c7-6fa9-f36b-e7eb-a368600e0a09?t=167536972982

1.2.8 Comprehensive Preparedness Guide 201 (CPG 201).

https://www.fema.gov/sites/default/files/2020-07/threat-hazard-identification-risk-assessment-stakeholder-preparedness-review-guide.pdf

1.2.9 The Stafford Act.

https://www.fema.gov/sites/default/files/2020-03/stafford-act_2019.pdf

1.2.10 Disaster Mitigation Act of 2000 (DMA2000).

https://www.fema.gov/sites/default/files/2020-11/fema_disaster-mitigation-act-of-2000_10- 30-2000.pdf

The following Acronyms forms a part of this specification:

COOP Continuity of Operations Plan HIPAA Health Insurance Portability and Accountability Act EMAP Emergency Management Accreditation Program NIMS National Incident Management System OEM Office of Emergency Management PDF Portable Document Format

1.3. Minimum Qualifications

The Proposer or principal thereof shall demonstrate recent experience in providing substantially similar services of the same scope and size.

1.4. Minimum Requirements

1.4.1 The Proposer shall provide, with Offer, a copy of the Proposer’s current System Security Plan(s). The plan(s) shall include specific and detailed information regarding encryption of electronic data and all methods used to secure data during transmission.

Upon County request, the Contractor shall provide updated plan(s), as applicable.

1.4.2 The Proposer/Contractor shall implement and maintain a comprehensive cybersecurity program in accordance with Attachment A – Cybersecurity Requirements.

https://preptoolkit.fema.gov/documents/4461741/40222908/FEMA+Comprehensive+Preparedness+Guide+%28CPG%29+101%2C+Developing+and+Maintaining+Emergency+Operations+Plans%2C+Version+3.0%2C+September+2021..pdf/f74300c7-6fa9-f36b-e7eb-a368600e0a09?t=167536972982 https://preptoolkit.fema.gov/documents/4461741/40222908/FEMA+Comprehensive+Preparedness+Guide+%28CPG%29+101%2C+Developing+and+Maintaining+Emergency+Operations+Plans%2C+Version+3.0%2C+September+2021..pdf/f74300c7-6fa9-f36b-e7eb-a368600e0a09?t=167536972982 https://preptoolkit.fema.gov/documents/4461741/40222908/FEMA+Comprehensive+Preparedness+Guide+%28CPG%29+101%2C+Developing+and+Maintaining+Emergency+Operations+Plans%2C+Version+3.0%2C+September+2021..pdf/f74300c7-6fa9-f36b-e7eb-a368600e0a09?t=167536972982 https://preptoolkit.fema.gov/documents/4461741/40222908/FEMA+Comprehensive+Preparedness+Guide+%28CPG%29+101%2C+Developing+and+Maintaining+Emergency+Operations+Plans%2C+Version+3.0%2C+September+2021..pdf/f74300c7-6fa9-f36b-e7eb-a368600e0a09?t=167536972982 https://www.fema.gov/sites/default/files/2020-07/threat-hazard-identification-risk-assessment-stakeholder-preparedness-review-guide.pdf https://www.fema.gov/sites/default/files/2020-07/threat-hazard-identification-risk-assessment-stakeholder-preparedness-review-guide.pdf https://www.fema.gov/sites/default/files/2020-03/stafford-act_2019.pdf https://www.fema.gov/sites/default/files/2020-11/fema_disaster-mitigation-act-of-2000_10-30-2000.pdf https://www.fema.gov/sites/default/files/2020-11/fema_disaster-mitigation-act-of-2000_10-30-2000.pdf

RFP-26-00333 Page 6

1.4.3 Approval Workflow

1.4.3.1 The software shall provide a customizable approval path and role delegation upon COOP submission, including the following roles:

1.4.3.1.1 Liaison – Responsible for preparing and submitting the departmental COOP.

1.4.3.1.2 COOP Committee Member – Conducts the initial review and provides the first-level approval of the COOP.

1.4.3.1.3 HIPAA Reviewer (as applicable) – For departments that handle protected health information, the software shall route the COOP for a mandatory HIPAA compliance review.

1.4.3.1.4 Departmental Director – Conducts the second-level review and approval of the

COOP.

1.4.3.1.5 Executive – Conducts the third-level review and approval of the COOP.

1.4.3.1.6 COOP Committee Chair (Emergency Management Director) – Conducts the final review and approval of the COOP.

1.4.3.2 The designated Liaison shall initiate the approval workflow by submitting a COOP plan, after which the software shall automatically route the plan to the appropriate reviewer(s) based on the configured approval path.

1.4.3.3 The software shall generate a notification email to the assigned reviewer that includes, at a minimum, the department name, review request status, and a secure link to access the COOP plan within the system. The software shall not transmit any COOP plan content or attachments in the email.

1.4.3.4 Upon each approval action, the software shall automatically route the COOP plan to the next reviewer defined in the configured workflow, including HIPAA review when applicable.

1.4.4 The software shall enforce completion of all required COOP fields in accordance with federal, state and industry standards, including Section 4.4 of the Emergency Management Accreditation Program (EMAP) Standards. The software shall automatically identify and flag any missing required data and shall not permit the draft to proceed for further review, approval, or submission until all required information has been completed, including the following required fields:

1.4.4.1 Delegation of Authority

1.4.4.2 Essential Function

RFP-26-00333 Page 7

1.4.4.3 Primary and Alternate Facilities

1.4.4.4 Security and Access

1.4.4.5 Teams and Responsibilities

1.4.4.6 Lines of Succession

1.4.4.7 Vital Records and Resources

1.4.4.8 Continuity of Communications

1.4.4.9 Tabletop Test, Training, and Exercise Templates and checklists on threats.

1.4.5 The software shall include customizable required subfields within each required COOP field.

1.4.6 The software shall be fully hosted on the Contractor’s cloud-based infrastructure and shall be accessible from any internet connection.

1.4.7 The general software requirements shall include, but not be limited to:

1.4.7.1 Support for a minimum of 250 simultaneous active users who are able to enter data and generate reports concurrently. Each user shall have the capability of generating a unique COOP plan for their respective departments.

1.4.7.2 Compatibility with Microsoft Office products, including Word and Excel as well as Adobe PDF.

1.4.7.3 Support Single Sign-On (SSO) authentication using Azure Active Directory (Azure AD).

1.4.7.4 Customizations to incorporate County branding, formatting, and document presentation requirements as determined by the OEM. The software branding shall be adaptable to accommodate changes in applicable federal, state, and industry standards throughout the term of this contract.

1.4.7.5 Data-entry features including, but not limited to, spell check, attachment uploads, copy/paste functionality, and drag-and-drop capabilities.

1.4.8 The Contractor shall work with the County to build and provide standardized templates and/or fillable forms within the software to ensure conformity across departments.

1.4.9 Dashboard and Status Tracking Requirements

1.4.9.1 The software shall provide configurable dashboard views that allow authorized users to monitor COOP development and approval progress at both the departmental and enterprise levels. Dashboard functionality shall include, but not be limited to:

RFP-26-00333 Page 8

1.4.9.1.1 Display of COOP submission status (E.g., not started, in progress, incomplete, complete).

1.4.9.1.2 Visual progress indicators such as color coding, completion percentages, or equivalent metrics.

1.4.9.1.3 Identification of missing or incomplete sections.

1.4.9.1.4 Last modified date and reviewer activity indicators.

1.4.9.1.5 Department-level summaries and enterprise-wide aggregate views of COOP completion status.

1.4.9.1.6 Status summary report documenting missing, incomplete, and completed COOP submissions.

1.4.9.1.7 Manual data refresh capability and optional automated refresh capability.

1.4.10 Access Levels

1.4.10.1 Role-Based Access Controls

1.4.10.1.1 The software shall provide role-based, tiered access controls for COOP reporting, including configurable user roles and permissions aligned with County-defined responsibilities.

1.4.10.1.2 At a minimum, the software shall support distinct access levels for administrative users, COOP committee members, COOP committee chairs, Executive users, and Departmental Liaisons. Access permissions shall be configurable to allow assignment of users to one or more roles as determined by the County.

1.4.10.1.3 Full access roles shall support the ability to view COOP submissions across multiple departments and perform review and approval actions for assigned COOP plans.

1.4.10.1.4 Partial access roles shall support the ability to create, draft, and manage COOP submissions for assigned departments.

1.4.10.2 Administrative Controls

1.4.10.2.1 The software shall support administrator-managed role assignment and permission maintenance, including the ability for designated authorized users to update access assignments to accommodate organizational changes, staffing turnover, and committee membership updates.

1.4.10.2.2 The software shall provide the following administrative capabilities:

RFP-26-00333 Page 9

1.4.10.2.2.1 Allow administrators to access and manage software content through a web portal compatible with the most current versions of Microsoft Edge, Google Chrome, and Apple Safari.

1.4.10.2.2.2 Assign user access levels and reporting rights.

1.4.10.2.2.3 Receive automated email alerts when COOP plans are submitted.

1.4.10.2.2.4 Add and delete users.

1.4.10.2.2.5 Modify user permissions.

1.4.11 County-owned Data

1.4.11.1 The County may require the Contractor to return all County Information at any time, upon written request by the OEM or its authorized designee. Upon such request, the Contractor shall return all County information in the format and manner directed by the County, no later than 30 Days.

1.4.11.2 The Contractor shall return all such information at no cost to the County. The County shall not be responsible for any costs associated with data extraction, formatting, conversion, or delivery.

1.4.11.3 Upon completion of the return process, the Contractor shall permanently delete or securely destroy all County Information remaining in its possession, except to the extent retention is required by applicable law and shall certify such deletion or destruction upon request.

1.4.12 Security

1.4.12.1 The software shall provide each administrator with a unique login consisting of an individual identifier and password.

1.4.12.2 The software shall support a minimum of five (5) administrators, with the ability to add more as needed.

1.4.12.3 The software shall enforce case-sensitive passwords with the following attributes:

1.4.12.3.1 A minimum length of 12 characters.

1.4.12.3.2 Support for both uppercase and lowercase letters.

1.4.12.3.3 Support for numeric characters and common symbols.

1.4.12.4 The software shall encrypt all data at rest and in transit.

RFP-26-00333 Page 10

1.4.12.5 The software’s data centers shall be located within the United States.

1.4.12.6 The Contractor shall regularly perform vulnerability assessments on the software and all programs utilized by the County. Upon the County's request, the Contractor shall provide the most current vulnerability assessment report.

1.4.12.7 The Contractor shall perform a penetration test on the software and all programs utilized by the County, at a minimum of once (1) per year. Upon the County's request, the Contractor shall provide the most current penetration test report.

1.4.12.8 The Contractor shall maintain documented Disaster Recovery Plans that preserve the integrity of the software and all associated data. The Contractor shall provide the County Project Manager (PM) with a timeline outlining notification procedures and coordination steps for data recovery in the event of a data loss. Upon the County's request, the Contractor shall provide the current Disaster Recovery Plan.

1.4.12.9 The Contractor shall coordinate all security-related aspects of the project with the County's Information & Innovation Office (IIO) Cyber Security Services Group. The Product and its internal and external security environments shall be subject to periodic security assessments by the County as well as a final assessment prior to the County accepting the Product into the production environment. The assessment shall include, but not be limited to, a technical security assessment of the final software conducted by the County’s IIO for integrating the solution with existing infrastructure and systems.

1.4.12.10 The Contractor shall maintain a redundant backup site with automatic failover in the event of a primary site failure.

1.4.13 Technical Support

1.4.13.1 The Contractor shall provide technical support for the software via email and telephone, Monday through Friday, 9:00 A.M. to 5:00 P.M., excluding County-observed Holidays.

1.4.13.2 The Contractor shall acknowledge all support requests within two (2) hours of receipt during standard support hours.

1.4.13.3 The Contractor shall use reasonable efforts to resolve reported issues in a timely manner based on the severity and impact to the system operations. Priority classifications and associated response and resolution targets shall be defined and agreed upon with the County during implementation and may be adjusted upon mutual agreement.

1.4.13.4 Email-based support shall be available outside of standard support hours, including weekends and County-observed holidays, for the submission of support requests.

RFP-26-00333 Page 11

1.4.14 Training

1.4.14.1 User Documentation and Help Materials

The Contractor shall provide comprehensive user documentation, including help guides embedded within the software, printable PDF materials, and reusable training resources such as recorded webinars or equivalent media, to the County no later than the first training session. All documentation shall be updated as necessary to reflect system enhancements, new features, configuration changes, and updates to applicable standards.

1.4.14.2 Initial Implementation Training

1.4.14.2.1 The Contractor shall provide initial implementation training prior to system go-live. Training shall be role-based and shall include, at a minimum:

1.4.14.2.1.1 COOP plan development training for Liaison users.

1.4.14.2.1.2 Review and approval workflow training for Committee Members, Departments Directors, Executives, and other approvers.

1.4.14.2.1.3 Administrative user training for designated system administrators, including user accounts, access management, troubleshooting, opening service tickets, and maintaining system data.

1.4.14.2.2 Initial training shall include hands-on instruction covering data entry, document attachment, workflow navigation, troubleshooting, system content, and COOP data structure. A minimum of three (3) days of in-person, on-site training shall be provided within 30 Days of system availability or as otherwise coordinated with the Project Manager.

1.4.14.3 Ongoing and Update Training

The Contractor shall provide ongoing training and updated instructional materials for all new system features, enhancements, or changes in applicable federal, state, or industry standards.

Refresher or update training shall be provided when material system changes occur and shall focus on the scope of the changes and their impact on system use.

1.4.14.4 Training Delivery and Logistics

1.4.14.4.1 Training shall be delivered through one or more of the following:

1.4.14.4.1.1 In-person instructor-led sessions.

1.4.14.4.1.2 Virtual instructor-led sessions.

1.4.14.4.1.3 Remote instructional support including telephone-based assistance.

RFP-26-00333 Page 12

1.4.14.4.2 The Contractor shall offer sufficient scheduling options to support County participation and shall accommodate group training sessions based on County operational needs. Training sessions shall be coordinated with the County and conducted during standard business hours. Standard business hours are Monday through Friday, 8:00 A.M. to 5:00 P.M. EST excluding County observed holidays.

1.4.15 Software Maintenance and Updates

1.4.15.1 The Contractor shall perform routine system maintenance necessary to ensure minimal disruption and downtime of the software. Maintenance activities shall be scheduled in coordination with the County, with advance notice provided for any planned downtime.

1.4.15.2 The system shall maintain a minimum uptime of 99.9%.

1.4.15.3 Routine maintenance and system updates shall be scheduled during periods of lowest system usage and aligned with County operational needs, including annual review and update cycles as identified by the County. Emergency fixes and critical patches shall also be deployed during periods of low system usage, including evenings, weekends, or other off-peak hours as coordinated with the County.

1.4.15.4 The Contractor shall provide annual maintenance services for the software, including, all necessary security patches, bug fixes, and system updates to maintain proper system functionality and security. Maintenance services shall also include updates required to support changes in applicable federal, state, and industry standards affecting data collection, reporting, or system functionality.

1.4.15.5 The Contractor shall test and validate all updates prior to deployment to the production environment and shall provide the County with advance notice of any updates, including a summary of changes and any potential impacts on system functionality or availability. The County shall have the opportunity to review and confirm system functionality following deployment to ensure existing functionality is not impacted.

1.4.15.6 Advance Notification Requirements

1.4.15.6.1 The Contractor shall provide the following advance notice for updates, patches, or system changes:

1.4.15.6.1.1 Five (5) Business Days for routine patches or updates.

1.4.15.6.1.2 Two (2) Business Days for emergency or critical patches.

1.4.15.6.2 All notifications shall include:

1.4.15.6.2.1 A description of the update or change.

1.4.15.6.2.2 The expected time of deployment.

RFP-26-00333 Page 13

1.4.15.6.2.3 Any anticipated impact to system availability or functionality.

1.4.15.6.3 Deployment shall occur during periods of low system usage when practicable, including evenings, overnight hours, or weekends, as coordinated with the County.

1.4.16 Project Management

1.4.16.1 The Contractor shall assign a dedicated Account Manager to oversee the implementation and ongoing management of the software.

1.4.16.2 The County will assign a Project Manager to coordinate and provide oversight of all deliverables in collaboration with the Contractor’s PM.

1.4.16.3 The Contractor’s Account Manager and the County’s Project Manager shall each be available, at a minimum, during standard business hours.

1.4.16.4 The County’s PM may reject work as defective if the work furnished by the Contractor does not comply with the requirements of the resulting contract.

1.4.16.5 Any changes in Account Manager or Project Manager assignments shall be communicated in writing by either party within three (3) Business Days and shall include all updated contact information for the new designee.

1.4.17 Meetings

1.4.17.1 Within 30 calendar days following contract award and prior to commencement of work authorized by the County PM, the Contractor shall participate in a post-award kickoff meeting with OEM to review and discuss implementation of the requirements set forth in this specification.

1.4.17.2 The County PM may schedule additional coordination meetings with the Contractor as necessary during implementation and post-implementation phases. Such meeting may be conducted via telephone or other remote communication methods, as determined by the County PM, to discuss implementation progress, coordination requirements, and any issues that may arise.

1.4.18 Implementation

1.4.18.1 The software shall be fully configured, branded, customized, tested, and ready for final acceptance no later than 45 Days after issuance of a Purchase Order.

1.4.18.2 The Contractor shall assist in identifying crisis team member roles, upload initial documents into the system, support the internal announcement and rollout of the software within the organization, and conduct the first message test.

RFP-26-00333 Page 14

1.4.19 Mobile Access Requirements

The software shall provide secure mobile application access (iOS and Android) that allows authorized users to download and view approved COOP plans in a read-only format for offline use during network outages. Only fully approved COOP documents shall be available for offline access through the mobile application.

1.4.20 Data Collection

1.4.20.1 The Contractor shall provide a data collection and management tool that enables departments to develop, maintain, review and share COOP plans in accordance with the requirements defined in Section 1.4.2.

1.4.20.2 The software shall support collection, organization, and reporting of COOP planning data and approvals necessary to generate finalized, audit-ready COOP documentation.

1.4.20.3 The software shall support configurable workflows and data structures to accommodate future expansion of functionality, including risk assessment and continuity planning initiatives, as determined by the County during the duration of this contract.

1.4.20.4 The software shall include tools or features supporting continuity planning analysis, scenario-based planning, and risk assessment activities.

1.4.20.5 The Contractor shall provide COOP plan review services consisting of one (1) annual review session conducted by an individual knowledgeable in continuity of operations and/or business continuity planning principles.

1.4.20.6 The annual review shall include evaluation of County COOP planning processes and submitted documentation for completeness, alignment with applicable standards, and identification of recommended improvements or missing planning components.

1.4.20.7 The Contractor shall provide written observations and recommendations resulting from the review process, including identification or potential gaps, deficiencies, or future planning considerations.

1.4.21 Final Acceptance

1.4.21.1 The County shall have 30 Days to determine whether the software meets all specification requirements for final acceptance. If final acceptance is not achieved, the 30 Day review period shall restart and continue until the County accepts the software. Final acceptance shall occur no later than 90 Days from the receipt of a Standard Purchase Order

(SPO).

1.4.21.2 The acceptance criteria shall include the following items:

1.4.21.2.1 All software malfunctions previously identified have been fixed.

RFP-26-00333 Page 15

1.4.21.2.2 All workflow processes are properly configured and validated by the County.

1.4.21.2.3 All security groups, roles, and user setups are properly configured and validated by the County.

1.4.21.2.4 All reports are properly configured and validated by the County.

1.4.21.2.5 Contractor shall be responsible for all costs associated with the final acceptance of the online system.

1.4.21.2.6 Payment shall be made after final acceptance and upon receipt of a correct invoice.

1.5. Instructions to Proposers

The Proposer shall submit a comprehensive Proposal that meets or exceeds the minimum qualifications and requirements of these specifications. The Proposer’s response shall contain sufficient detail to permit the County to properly evaluate the Proposer’s qualifications, experience, system capabilities and security, overall approach, and implementation plan, to include the following:

1.5.1 An Executive Summary as an attachment, which shall include:

1.5.1.1 Cover Page with the following:

1.5.1.1.1 Name and title of the Proposer’s contact representative for the County, as well as the name and title of the engagement manager, if different from the contact representative.

1.5.1.1.2 Proposer’s address

1.5.1.1.3 Proposer’s phone number

1.5.1.1.4 Proposer’s website link

1.5.1.2 Organizational chart identifying the functions and reporting relationships of key personnel.

1.5.1.3 Proposer’s history, date established, overview, and organizational profile.

1.5.1.4 Summary of Proposer’s understanding of the scope and objectives of these specifications.

1.5.1.5 Experience: A minimum of three (3) client references, documenting experience implementing solutions for organizations substantially similar in scope and size to Hillsborough County, to include but not limited to:

RFP-26-00333 Page 16

1.5.1.5.1 Client Name and Address

1.5.1.5.2 Contact Name and Title

1.5.1.5.3 Contact Email

1.5.1.5.4 Contact Phone Number

1.5.1.5.5 Project Title

1.5.1.5.6 Brief description of the project and implementation date

1.5.1.6 Qualifications: A written summary of Proposer’s organization and staff qualifications that demonstrate the Proposer’s quality of services (general information, resumes, etc.).

1.5.2 The Proposer’s Solution Details, as a separate attachment, to include, but not limited to, Solution name, features, accessible reporting features within various exporting options, brochure(s), and integration format and layout, documenting how the Solution meets or exceeds the requirements of this solicitation.

1.5.3 A copy of Proposer’s System Security Plan(s), as a separate attachment.

1.5.4 A completed Vendor Security & Compliance Questionnaire – Outsourced, as a separate attachment.

1.5.5 A completed AI Security Questionnaire, if applicable, as a separate attachment.

1.5.6 An Implementation Plan, as an attachment, that guides the process, minimizes risks and achieves successful outcomes that meets the needs of the County, minimizes disruptions, and provides a smooth transition. The Implementation Plan shall include a clear alignment of both functional and technical objectives, resource optimization, communication, risk mitigation, monitoring and evaluation processes, and a timeline.

1.5.7 A detailed Training Plan, as an attachment, with a full description of the standard training offered by the firm for the product proposed, to include but not limited to:

1.5.7.1 Technical/Customer Support Information

1.5.7.2 Report samples, and other literature/information, such as samples, payment receipts, detailed transaction reports, calendars, and class rosters.

1.5.7.3 In-Person and on-line training, as per Paragraph 1.4.13 (Training).

1.5.8 Cost Proposal

RFP-26-00333 Page 17

1.5.8.1 The Proposer shall submit a cost proposal using the Proposal Pricing Table for the overall cost of the initial contract term, including professional services for implementation, testing and training, support services, and software solution subscription for years one (1), two (2), and three (3). Any other costs associated with the proposed solution shall also be included to reflect the overall cost to the County.

1.5.8.2 The Proposer shall submit, as an attachment, the Implementation Phase Milestones, with a cost breakdown for progress payments, to include work activities/events to cover the three (3) main phases of the project: 1 Implementation, 2 Testing, 3 Training, and 4) Final Delivery.

1.5.8.2.1 The sum of the work activities/events, as applied to each phase, shall equal the total cost proposed for Line one (1) of the Proposal Pricing Table.

1.5.8.2.2 Progress payments will be made to the awarded Contractor based upon the services completed per the Implementation Phase Milestones.

1.5.9 Upon County request, a copy of the Proposer’s Disaster Recovery Plan shall be provided.

1.6. Proposal Response (Attachments)

The Proposer shall submit as their proposal the following required attachments. Note: Euna Procurement has a file size limitation of 1GB.

1.6.1 Submit with Proposal

1.6.1.1 Proposer Requirements/Acknowledgements Questionnaire

1.6.1.2 Deviation(s) Questionnaire (Optional)

1.6.1.3 Proposer Acknowledgement(s) of Addenda (if applicable)

1.6.1.4 Declaration of Documents Exempt from Public Disclosure (Optional, if applicable)

1.6.1.5 Software License Terms, if requesting changes to the County’s standard provisions (Optional)

1.6.1.6 Executive Summary

1.6.1.7 Licenses and Certifications

1.6.1.8 Solution Details

1.6.1.9 System Security Plan(s)

1.6.1.10 Vendor Security & Compliance Questionnaire

RFP-26-00333 Page 18

1.6.1.11 AI Security Questionnaire (if applicable)

1.6.1.12 Implementation Plan

1.6.1.13 Training Plan

1.6.1.14 Implementation Phase Milestones

1.6.2 Complete upon County’s Request

1.6.2.1 Insurance Certificate

1.6.2.2 W-9 or Substitute W-9

1.6.2.3 Disaster Recovery Plan

2. SPECIAL TERMS AND CONDITIONS

2.1. Evaluation/Selection Process

2.1.1 The County will review and evaluate all Proposals submitted in response to this Solicitation Document. The evaluation process is designed to award the Contract to the Proposer with the best combination of attributes as demonstrated in the Proposal scores. Scores are based on the evaluation of the information contained in Proposer's Proposal which include, but is not limited to, Proposer's responses to the questions set forth in the Requirements Section of this Solicitation Document and any corresponding attachments including a brief description of methodology, qualifications, experience, and the cost of the Services/Work.

2.1.2 Evaluation Procedures

The evaluators will consider how well the Proposer's Proposal meets the needs of the County as described in the Proposer's response to each question in this Solicitation Document. It is important that the responses be clear and complete so that the evaluators can adequately understand all aspects of the response. Please follow all instructions carefully. The Proposal should be submitted according to the instructions/outline specified in this Solicitation Document.

A Proposal that fails to follow these instructions may be considered non-responsive and may be eliminated from further consideration.

2.1.2.1 Based on information acquired through the Proposer's responses and the responses of references (if applicable), the County will award a preliminary score to each Proposal.

2.1.2.2 Based on the preliminary scores, the County may request that the top scoring Proposers conduct an oral presentation and/or submit a Best and Final Offer that may include revisions to Technical Approach, Integration, and/or Cost. Be advised that the evaluators may revise the preliminary scores based on the oral presentations (if applicable), reference

RFP-26-00333 Page 19 inquiries, other information obtained through the County's investigations of past performance and/or submissions of Best and Final Offers (if applicable).

2.1.3 Scoring/Weighting of Questions

The scoring/weighting of Proposals will be accomplished utilizing the evaluation criteria identified in the following table:

Award Criteria Point Value Quote/Cost Total. 10 Proposer's understanding of the scope and objectives, technical approach and work plan presented.

Quality of the Proposed System and its ability to achieve the County's objectives

Proposer’s Organization and Staff Qualifications and Experience.

Total: 100

2.1.3.1 Quote/Cost Total: Points awarded for the "Quote/Cost Total" portion of this Solicitation Document will be based upon the following formula:

Score = Lowest Cost Proposal x Maximum Points Divided by Other Proposer's Cost

2.1.3.2 The County reserves the right not to award the Contract to the Proposer with the lowest Quote/Cost.

2.2. Health Insurance Portability and Accountability Act (HIPAA)

Offeror shall comply with the requirements of the Health Insurance Portability and Accountability Act (HIPAA), as amended, P.L. 104-191, 45 C.F.R. 160 and Part 164, as amended. The awarded Offeror shall be required to execute the HIPAA Business Associate Agreement (attached) upon notification of award.

2.3. Insurance, Contractor

See RFP-26-00333 Insurance Requirements Attachment

2.3.1 No work for the County shall commence or occupancy of any of its property take place until the required Certificates of Insurance and copies of the policies, if requested, are received by the County and written Notice to Proceed is issued to the Contractor by the County.

RFP-26-00333 Page 20

2.3.2 The insurance coverages and limits required of the Contractor under the Contract Documents are designed to meet the minimum requirements of the County. They are not designed as a recommended insurance program for the Contractor. Contractor shall be responsible for the sufficiency of its own insurance program. Should the Contractor have any questions concerning its exposure to loss under the Contract Documents or the insurance coverages needed therefore, it should seek professional assistance.

2.3.3 If the insurance coverage initially provided by the Contractor is to expire prior to completion of the Work, renewal Certificates of Insurance shall be furnished to the County the ten (10) Days prior to expiration of current coverages.

2.3.4 Should the Contractor fail to maintain the insurance coverages required by the Contract Documents, the County may, at its option, either terminate this Agreement for default or procure and pay for such coverage, charge the Contractor for and deduct the costs of the same from payments due the Contractor. A decision by the County to procure and pay for such insurance coverage shall not operate as a waiver of any of its rights under the Contract Documents.

2.3.5 Failure of the Contractor to submit the required Certificates of Insurance within the times required by this Section may result in a delay in issuing the Notice to Proceed. The parties specifically agree that such a delay is neither excusable nor compensable and will not entitle the Contractor to a change in the Contract Price or Time.

2.4. Information Technology

2.4.1 Software Licensing Provisions

2.4.1.1 Unless otherwise proposed, the Standard Software Licensing Provisions below shall apply. Proposers may include their firms' licensing provisions as an alternative to the Standard Software Licensing Provisions. Proposers are cautioned not to incorporate any terms or conditions into their proposed software license provisions other than those that are customary and/or usual or which result in a modification to their proposal. Such inclusions may result in the rejection of their Proposal in its entirety.

2.4.1.2 Scoring of Software Licensing Provisions: Software licensing provisions will be evaluated and scored by the County as follows:

2.4.1.2.1 Proposals that contain no alternative software licensing provisions: These proposals shall receive the maximum score allowed as identified within this Request for Proposal (RFP).

2.4.1.2.2 Proposals that contain alternative software licensing provisions: The County will score how closely the proposers' software license provisions match the Standard Software Licensing Provisions with more points awarded for fewer deviations.

RFP-26-00333 Page 21

2.4.1.3 Selection of Apparent Successful Proposer and Negotiation of Software License Provisions: The apparent successful proposer will be the vendor with the best combination of attributes as demonstrated in the solicitation scores.

2.4.1.3.1 Negotiations: If necessary, the County will enter into negotiations of the software license provisions with the apparent successful proposer in order to agree to mutually acceptable provisions. These negotiations shall be limited to a reasonable time period. If in the County’s sole determination the negotiations exceed a reasonable time period, the County shall terminate the negotiations with the apparent successful proposer and enter into negotiations with the next highest scoring proposer.

2.4.1.3.2 Successive apparent successful proposer(s): Upon failure to negotiate mutually acceptable software license provisions, and termination of negotiations with the apparent successful proposer, the next highest scoring proposer will become the new apparent successful proposer and the County will enter into negotiations of the software license provisions with this vendor as described in the previous paragraph. This process shall be repeated if necessary to obtain mutually acceptable software license provisions.

2.4.1.4 Standard Software Licensing Provisions

2.4.1.4.1 Licensed System, Services: The Contractor/Licensor (Licensor) grants and County accepts upon the terms and conditions contained herein, nontransferable license to use of "Licensed System" as herein defined and described. This Licensed System shall be used solely for the County's own purposes. The Licensed System shall include in its meaning, any improvements, additions, or modifications of the version or versions of the Licensed System which Licensor has licensed the County to use, and materials, documentation and technical information provided to County in written form and identified in the RFP, for use in connection with the Licensed System. The Licensor further agrees to perform certain services relating to the Licensed System as set forth herein.

2.4.1.4.2 Payment for Software: The County shall pay the Contractor/Licensor the license fee in full within forty-five (45) days upon delivery of the software and receipt of a proper invoice as defined in the Hillsborough County Prompt Payment Procedures, which are on file at the Board of County Commissioners Accounting Department, County Center, 601 E. Kennedy Blvd., 12th Floor, Tampa, Florida 33602.

2.4.1.4.3 Copies: The County shall have the right to reproduce for internal use all of the Licensed System and Documentation described in RFP for its internal users, subject to the requirements on use, disclosure, and proprietary notice set forth herein.

2.4.1.4.4 Proprietary Information: To the extent authorized by Florida law, the parties agree to take reasonable steps to preserve the confidential and proprietary nature of information provided by the other party. The County shall include and shall not alter, remove or cancel, any copyright, trade secret or other proprietary notices on the Licensed System.

RFP-26-00333 Page 22

2.4.1.5 Warranties

2.4.1.5.1 Licensed System; Services: Licensor warrants that, on the Acceptance Date, the Licensed System furnished hereunder shall be free from significant programming errors and from defects in workmanship and materials, and shall operate and conform to the performance capabilities, specifications, functions and other descriptions and standards applicable thereto as set forth in the RFP; that, in general, the Licensor shall perform the services in a timely and professional manner utilizing qualified professional personnel;

and that the Licensed System and service shall conform to the standards generally observed in the industry for similar Licensed Systems and services. If the Licensor allows the County to modify the source code, the County will adhere to the Licensor prescribed procedures for such modifications. The warranty shall not be invalidated if the County modifies the code in accordance with Licensor prescribed procedures.

2.4.1.5.2 Ownership; Authority: Licensor warrants that it has full power and authority to grant the rights granted by these License Provisions to County with respect to Licensed System without the consent of any other person or entity. Licensor also warrants that neither the performance of the services by Licensor nor the license to and use by County of the Licensed System and documentation, including the copying of the Licensed System and documentation, will in any way constitute an infringement or other violation of any copyright, trade secret, trademark, patent, invention, proprietary information, nondisclosure or other rights of any third party.

2.4.1.5.3 Compliance with Applicable Laws: Licensor warrants that Licensed System, its license to and use by County, and the performance by Licensor of the services, shall be in compliance with all applicable laws, rules and regulations.

2.4.1.5.4 Licensor's Fulfillment Of Warranty Obligations: If, at any time during the twelve

(12) month period immediately following the Acceptance Date, Licensor or County, or both, discover any defects, errors or non-conformities in the Licensed System or any other respect in which the Licensed System fails to conform to the provisions of any warranty contained in these License Provisions, Licensor shall, at no cost to the County, promptly correct such defects, error(s) or non-conformities by, among other things, supplying the County with such corrective codes and making such additions, modifications, or adjustments to the package as may be necessary to keep the Licensed system in operating order in conformity with the warranties herein.

2.4.1.5.5 Limited Warranty: Licensor's warranties are limited to those set forth in this agreement and do not include any other express or implied warranties, including implied warranty of merchantability and fitness for a particular purpose.

2.4.1.5.6 Limitation of Liability: In no event shall Licensor be liable for any indirect, exemplary, incidental, or consequential damages arising out of or otherwise relating to the use or performance of the System or any components thereof, however caused, even if Licensor has been advised of the possibility or likelihood of such damages.

RFP-26-00333 Page 23

2.4.1.6 Improvements; Modifications

2.4.1.6.1 Improvements, which shall mean any additions or modifications made by the Licensor to or in the Licensed System at any time after acceptance testing in the Licensed System, that improve the efficiency and effectiveness of the basic program function(s) described in the RFP and which do not change such function(s) or create one or more new ones, shall be furnished to the County at no charge, provided the County maintains current support with the Licensor.

2.4.1.6.2 Program Changes. If, at any time after the Acceptance Date, Licensor shall develop any changes in the Licensed System which affect the basic program, function(s) of the Licensed System, or adds one or more new ones, these shall be furnished to the County at no charge, provided the County maintains current support with the Licensor.

2.4.1.7 Indemnification

2.4.1.7.1 Licensor agrees to defend, indemnify, and shall hold harmless County, its employees and agents from and against any claim, suit, demand, or action alleging that the System or any component thereof infringes a U.S. patent or copyright, or any Trade Secret, or any other intangible property rights of any third party.

2.4.1.7.2 If a third-party claim seriously endangers or disrupts County's quiet enjoyment and use of the Licensed System, Licensor shall:

2.4.1.7.2.1 replace the Licensed System, at no additional charge, with a compatible, functionally equivalent and non-infringing product, or

2.4.1.7.2.2 modify the Licensed System,…